From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754166AbdGNMK4 (ORCPT ); Fri, 14 Jul 2017 08:10:56 -0400 Received: from mout.kundenserver.de ([217.72.192.74]:59317 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753787AbdGNMKx (ORCPT ); Fri, 14 Jul 2017 08:10:53 -0400 From: Arnd Bergmann To: linux-kernel@vger.kernel.org, Karsten Keil , Geliang Tang , "David S. Miller" , Arnd Bergmann Cc: Greg Kroah-Hartman , Linus Torvalds , Guenter Roeck , akpm@linux-foundation.org, netdev@vger.kernel.org, "James E . J . Bottomley" , "Martin K . Petersen" , linux-scsi@vger.kernel.org, x86@kernel.org Subject: [PATCH 08/22] isdn: divert: fix sprintf buffer overflow warning Date: Fri, 14 Jul 2017 14:07:00 +0200 Message-Id: <20170714120720.906842-9-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20170714120720.906842-1-arnd@arndb.de> References: <20170714120720.906842-1-arnd@arndb.de> X-Provags-ID: V03:K0:jGC1CMG28/iTtuI7HY0xqX7ZOWjXUB/brD0xL7o1swOJ92a9DwI vzv6XQlNuH2ctRAl88Apw/RJ2SrWEKAIZBYFAXp12mZBMLzp+R1yBrZDsiY7k3gaVMlALGG MviO/BaA3f/l+JMFOAJQvz3nI9Voueo7KY/3E49asvzkyv3s2GfrhynO4vxyD2hN0N+qIPs Aigck3AimSw5ZBwK1qWog== X-UI-Out-Filterresults: notjunk:1;V01:K0:uhVPpDTwJSQ=:4zL6AJ5xCRzze1G0OKJsB7 CgaTtKUIE7XY80NFWlH6iQ9UBlnbEwthRjD16XUvY3sAWgFMWgc+IVRhtI9nCAK18PmyM9y85 p+kxb+lQq0PkYEA+zz2XSTqJSBy383/NCKlcIA0rn4QqAf1if63f4zwoxcf3OvvSGdQ3hejQZ 5AZxmoydVye/7Q35VavLx/6kFKJOA3Snf4sXn9ZIp3QeE+O3p5RXj9Pyrg5txDNNE7Ipr2o9i OtoZ1Idg/AhdCh8kGq4Nc+FZFzW3P8V/sFn5E5F49wqWG8Hb1JW8cOL19CdN3UfQxGdEheT9i N6OHQpqGX3vBAkr5/ASHwfUyOiKdQ00OYeOeq/nsXg+xX7qoqrulD6sJtCUC9gjcFl5Mojx8m eNPHCL+N1wInbf31ix+FMFK3hkjg01lRkSdKS7tIWjAD7soTPnnwM5rMXm9eBh26NqA2ssiKr xPV25Uf9BSmwtYd0iB03IWfMXswHIVn8R4tyVLblOdDdLBmygMBxGyuPnn7JnwDhn1Oeu6npa wydI2lJ2Fgy3uszoANp+1bH4Q+dcCX7ndIje6ndrxRiiABsJAkNAhuPd6YsrHIWXQ+Zbu4KZ6 SR9LDhsuCBn6kGYsjOpwbezcXShmyI7vtxWQuQA2rUR1dVqD7FV3f+Z5d0LfQN9YmsCEi3YWy zfDv2mS5xL6gC23ce678jbi+8BW5eOIzQUnvFq0GxZkSeA2chn2BV8BgZxO3d1CxxMXJzyBVF GlEHbT97BW0MdlEqWZBQ3GQnKTuQD225b+IDew== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org One string we pass into the cs->info buffer might be too long, as pointed out by gcc: drivers/isdn/divert/isdn_divert.c: In function 'll_callback': drivers/isdn/divert/isdn_divert.c:488:22: error: '%d' directive writing between 1 and 3 bytes into a region of size between 1 and 69 [-Werror=format-overflow=] sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/isdn/divert/isdn_divert.c:488:22: note: directive argument in the range [0, 255] drivers/isdn/divert/isdn_divert.c:488:4: note: 'sprintf' output 25 or more bytes (assuming 129) into a destination of size 90 This is unlikely to actually cause problems, so let's use snprintf as a simple workaround to shut up the warning and truncate the buffer instead. Signed-off-by: Arnd Bergmann --- drivers/isdn/divert/isdn_divert.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c index 060d357f107f..6f423bc49d0d 100644 --- a/drivers/isdn/divert/isdn_divert.c +++ b/drivers/isdn/divert/isdn_divert.c @@ -485,18 +485,19 @@ static int isdn_divert_icall(isdn_ctrl *ic) cs->deflect_dest[0] = '\0'; retval = 4; /* only proceed */ } - sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n", - cs->akt_state, - cs->divert_id, - divert_if.drv_to_name(cs->ics.driver), - (ic->command == ISDN_STAT_ICALLW) ? "1" : "0", - cs->ics.parm.setup.phone, - cs->ics.parm.setup.eazmsn, - cs->ics.parm.setup.si1, - cs->ics.parm.setup.si2, - cs->ics.parm.setup.screen, - dv->rule.waittime, - cs->deflect_dest); + snprintf(cs->info, sizeof(cs->info), + "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n", + cs->akt_state, + cs->divert_id, + divert_if.drv_to_name(cs->ics.driver), + (ic->command == ISDN_STAT_ICALLW) ? "1" : "0", + cs->ics.parm.setup.phone, + cs->ics.parm.setup.eazmsn, + cs->ics.parm.setup.si1, + cs->ics.parm.setup.si2, + cs->ics.parm.setup.screen, + dv->rule.waittime, + cs->deflect_dest); if ((dv->rule.action == DEFLECT_REPORT) || (dv->rule.action == DEFLECT_REJECT)) { put_info_buffer(cs->info); -- 2.9.0